Data Loss Prevention

 View Only
  • 1.  Data source imports failed and cant load attribute lookup

    Posted Feb 11, 2014 01:21 AM

    Hi

    When I am trying to import data source getting failed error and in logs found that there data incinsitancy, in log duplicate email ID was shown.

    Also when trying to run manually lookup to get user and manager details it not retrives any information.Any possibille solutions



  • 2.  RE: Data source imports failed and cant load attribute lookup

    Broadcom Employee
    Posted Feb 11, 2014 01:50 AM

    can you post the snippets of the log?



  • 3.  RE: Data source imports failed and cant load attribute lookup

    Trusted Advisor
    Posted Feb 13, 2014 12:31 PM

    Salim,

    Are you trying to add inforrmation in the "Users > Data Sources" section so you can use the User Risk Reporting?

    I have been working with this for a while and have some examples on it..

    When the error states that you have duplicate emails, it means that you have some users that have multiple accounts (Normal Account snd Admin Accounts) and each account has the SAME email address. The importing for User Risk reporting does not like this. As a result you need to create the User Source with some AD custom filter to remove the duplicates during importing.

    See the following to see what you need to do..

    1. Read the logs and find which emails are duplicates and add them to the following filter.

    2. Also inventory your users and filter out any possible "test" accounts or NON-user accounts. You can add them to the filter by using the following (!(cn=evaltest*)) . This says DO NOT include any account with the FIRST NAME of "evaltest1" or "evaltestxyz" etc. This makes for a clean import

    (&(!(mail=juser1@company.com))(!(mail=buser2@company.com))(!(employeeNumber=svc))(!(msExchResourceSearchProperties=Room))(!(msExchResourceDisplay=Room))(!(displayName=Pager*))(!(givenName=Room)))

    After you have done this I would then ADD those user accounts that were duplicate and you filtered out. Though ONLY add the NORMAL user account with the following filter:

    (&(sAMAccountName=username1))

    When adding the filter to the system make sure you have the right number of open and close parenthisis ")"

    Hope this makes sense.

    If this solves your questions please marked as solved.

    Ronak